3 ms·
MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rat
by nwh 13y ago
MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.
- jaggederest 13y agoRight, but my point is that the CA is the central point of failure for all of those scenarios.
- nwh 13y agoNot really. For a passive attack the key would have to be stolen from a server rather then the CA, who never sees the private key, rather only the CSR (public key).
- jaggederest 13y agoWe're assuming under the current circumstances that it's backdoored, basically. The NSA definitely doesn't want to have to go knock on doors to collect those private keys.